— Esto estaba en el Youtrack

La opción que parece funcionar es:

• /etc/docker/daemon.json

{
"iptables": false
}

y en /etc/csf/csf.conf la opción:

"DOCKER": "0"

He replicado la configuración que genera Docker de forma automática. Este script habría que habilitarlo en /usr/local/include/csf/post.d/docker.sh:

#!/bin/bash
IPT="iptables"

${IPT} -N DOCKER
${IPT} -N DOCKER-ISOLATION-STAGE-1
${IPT} -N DOCKER-ISOLATION-STAGE-2
${IPT} -N DOCKER-USER

${IPT} -A FORWARD -j DOCKER-USER
${IPT} -A FORWARD -j DOCKER-ISOLATION-STAGE-1
${IPT} -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
${IPT} -A FORWARD -i docker0 ! -o docker0 -j ACCEPT
${IPT} -A FORWARD -i docker0 -o docker0 -j ACCEPT

${IPT} -A FORWARD -o docker0 -j DOCKER

${IPT} -A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
${IPT} -A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP

DOCKER_CONTAINERS=`docker ps -q | xargs`

for DOCKER_NET in `docker network ls -q | xargs`;do
        echo -e "\n\n[**] ${DOCKER_NET}\n\n"
        DOCKER_IP_ROW=`ip route | grep br-${DOCKER_NET} | cut -d ' ' -f 1,9`
        if [ ! -z "${DOCKER_IP_ROW}" ];then
            DOCKER_IP_ARR=($DOCKER_IP_ROW)
            if [ ${#DOCKER_IP_ARR[@]} -eq 2 ];then
                DOCKER_IP_MASK=${DOCKER_IP_ARR[0]}
                DOCKER_IP_GW=${DOCKER_IP_ARR[1]}
                
                ${IPT} -A FORWARD -o br-${DOCKER_NET} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
                ${IPT} -A FORWARD -o br-${DOCKER_NET} -j DOCKER
                ${IPT} -A FORWARD -i br-${DOCKER_NET} ! -o br-${DOCKER_NET} -j ACCEPT
                ${IPT} -A FORWARD -i br-${DOCKER_NET} -o br-${DOCKER_NET} -j ACCEPT
                ${IPT} -A DOCKER-ISOLATION-STAGE-1 -i br-${DOCKER_NET} ! -o br-${DOCKER_NET} -j DOCKER-ISOLATION-STAGE-2
                ${IPT} -A DOCKER-ISOLATION-STAGE-2 -o br-${DOCKER_NET} -j DROP
                
                for DOCKER_CONTAINER in $DOCKER_CONTAINERS;do
                    PORTS_OPEN=`docker port ${DOCKER_CONTAINER} | awk '{print $1}' | xargs`
                    
                    CONTAINER_IPS=(`docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' ${DOCKER_CONTAINER} | xargs`)
                    CONTAINER_GW=`docker inspect -f '{{range.NetworkSettings.Networks}}{{.Gateway}}{{end}}' ${DOCKER_CONTAINER} | xargs`
                    
                    COUNT=0
                    
                    for GW in $CONTAINER_GW;do
                        if [ "${GW}" = "${DOCKER_IP_GW}" ];then
                            CUR_PORT_OPEN_NUMBER=""
                            CUR_PORT_OPEN_PROTOCOL=""
                            for PORT_OPEN in $PORTS_OPEN; do
                                PORT_OPEN_NUMBER=`echo $PORT_OPEN | awk -F "/" '{print $1}'`
                                PORT_OPEN_PROTOCOL=`echo $PORT_OPEN | awk -F "/" '{print $2}'`
                                
                                if [ "${CUR_PORT_OPEN_NUMBER}" != "${PORT_OPEN_NUMBER}" ] || [ "${CUR_PORT_OPEN_PROTOCOL}" != "${PORT_OPEN_PROTOCOL}" ];then
                                        ${IPT} -A DOCKER -d ${CONTAINER_IPS[${COUNT}]}/32 ! -i br-${DOCKER_NET} -o br-${DOCKER_NET} -p ${PORT_OPEN_PROTOCOL} -m ${PORT_OPEN_PROTOCOL} --dport ${PORT_OPEN_NUMBER} -j ACCEPT
                                fi
                                
                                CUR_PORT_OPEN_NUMBER="${PORT_OPEN_NUMBER}"
                                CUR_PORT_OPEN_PROTOCOL="${PORT_OPEN_PROTOCOL}"

                         
                         done
                        
                        
                        fi
                        
                        COUNT=(${COUNT}+1)
                        
                    done
                    


                done
            
            fi            
        fi
        
done

${IPT} -A DOCKER-ISOLATION-STAGE-1 -j RETURN
${IPT} -A DOCKER-ISOLATION-STAGE-2 -j RETURN
${IPT} -A DOCKER-USER -j RETURN

Para reiniciar las reglas se puede hacer con ` .
https://forums.docker.com/t/docker-firewall-rules-how-to-change-or-disable/30398/2

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT

Cualquier cambio hay que hacer un

csf -r